Data loss prevention (DLP) is a serious technology that addresses the serious issues around information risks. However, even serious topics can benefit from an injection of humor to help illustrate the issues. Here is our second cartoon in the short series about The (Mis)Adventures of Dave L. Preston that explores the insider impact on data loss.

Myth #5 – Classroom-format employee security education works

Origin

This is another well-documented "fact" found in security textbooks that turns out to be largely false.  No one would argue that its bad thing for employees to know the basics about compliance with state, federal, and enterprise regulations and policies. But what most practitioners don't realize is that basic classroom-format training has little measurable effect on employee-driven data loss rates.

What we see

We've run hundreds of DLP risk assessments at large enterprises.  In many of these engagements, we've scheduled the assessment in tandem with employee privacy training in an attempt to measure changes in behavior that the training might elicit.  Amazingly, we've never...

Myth #3 -- Information Classification is a necessary pre-requisite to protecting your data

Origin

Not only does this myth receive strong implicit backing from many security textbooks, there's also a whole flotilla of startups and a phalanx of security analysts making this claim.  To anyone who hasn't seen a DLP solution at work in a large enterprise environment, it at least looks plausible that this myth is in fact true.

What we see

This myth has received some pretty thorough rebuking by Data Loss Prevention deployments.  Projects that attempt to classify everything first before moving on to remediation of their data exposure problems invariably end in one of two ways: 1) the project runs out of time and money before all assets can be classified, or 2) a...

Myth #1 -- The vendor community does not solve the problems most in need of solving

Origin of this myth

You hear this implicit accusation from many parties (analysts chief among them).  A typical example is in Shostack’s and Stewart’s “The New School of Information Security”. A quote that is emblematic of this attitude: “There's an elephant in the room.  That elephant is the assumption that the security industry has evolved to solve the problems most in need of solving”.  [p.27]

We see things differently

Working at the leading vendor of Data Loss Prevention solutions provides a pretty interesting vantage point on current security tradecraft.  We have unique insight on the real terms of treatment of the most sensitive data at some...